← Advisories

KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure

Medium
Advisory ID
ZSL-2021-5656
Release Date
20 July 2021
Vendor
KevinLAB Inc. - http://www.kevinlab.com
Affected Version
4ST L-BEMS 1.0.0 (Building Energy Management System)
Tested On
Linux CentOS 7, Apache 2.4.6, Python 2.7.5, PHP 5.4.16, MariaDB 5.5.68
Summary

KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.

Description

The BEMS suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the 'page' GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Proof of Concept
Disclosure Timeline
05.07.2021Vulnerability discovered.
08.07.2021Vendor contacted.
12.07.2021No response from the vendor.
13.07.2021Vendor contacted.
19.07.2021No response from the vendor.
20.07.2021Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
20.07.2021Initial release
21.07.2021Added reference [1], [2] and [3]
22.07.2021Added reference [4]
11.04.2022Added reference [5]